What is claimed is: 



1 LA system for distributing portable computer virus definition 

2 records with binary file conversion, comprising: 

3 a structured virus database storing one or more virus definition records, 

4 each virus definition record comprising: 

5 an identifier uniquely identifying a computer virus; 

6 at least one virus name associated with the computer virus; 

7 a virus definition sentence comprising object code providing 

8 operations to detect the identified computer virus within a computer system; and 

9 a virus removal sentence comprising object code providing 

1 0 operations to clean the identified computer virus from the computer system; 

1 1 a client database engine storing at least one updated virus definition record 

12 into the structured virus database indexed by the identifier and the at least one 

13 virus name for each virus definition record; and 

14 a converter converting the virus definition records stored in the structured 

15 virus database into a virus data file comprising virus definition sets, each virus 

1 6 defmition set comprising: 

1 7 binary data encoding instructions to detect the computer virus 

1 8 within a computer system; 

1 9 instructions to clean the computer virus firom the computer system; 

20 and 

21 names associated with the computer virus. 

1 2. A system according to Claim 1 , fiarther comprising: 

2 a client anti-virus language decompiler converting each virus definition set 

3 in the virus data file into a virus definition record. 

1 3 . A system according to Claim 1 , fiorther comprising: 

2 a server database engine comparing subsequently modified versions of the 

3 structured virus database to form a delta set of virus definition records; and 



0181.0Lap2 



-14- 



4 the client database engine storing the delta vims definition records set into 

5 the structured virus database. 



1 4. A system according to Claim 3, further comprising: 

2 a server database engine building the virus definition records into the 

3 structured virus database by generating the identifier for each virus definition 

4 record and populating each virus definition record with the virus definition 

5 sentence and the virus removal sentence for the computer virus. 

1 5. A system according to Claim 4, further comprising: 

2 a server anti- virus language decompiler converting each virus definition 

3 set in the virus data file into a virus definition record. 

1 6. A system according to Claim 1 , fiirther comprising: 

2 the database engine accessing the virus definition records in the structured 

3 virus database to perform at least one of adding, removing, and replacing a virus 

4 definition record. 

1 7. A system according to Claim 1, fiirther comprising: 

2 a compression module compressing the structured virus database prior to 

3 transfer; and 

4 a decompression module decompressing the structured virus database 

5 subsequent to transfer. 

1 8. A system according to Claim 1, further comprising: 

2 an encryption module encrypting the structured virus database prior to 

3 transfer; and 

4 a decryption module decrypting the structured virus database subsequent 

5 to transfer. 

1 9. A system according to Claim 1 , wherein the structured virus 

2 database is a relational database. 
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1 1 0. A method for distributing portable computer virus definition 

2 records with binary file conversion, comprising: 

3 storing one or more virus definition records into a structured virus 

4 database, each virus definition record comprising: 

5 an identifier uniquely identifying a computer virus; 

6 at least one virus name associated with the computer virus; 

7 a virus definition sentence comprising obj ect code providing 

8 operations to detect the identified computer virus within a computer system; and 

9 a virus removal sentence comprising object code providing 

1 0 operations to clean the identified computer virus from the computer system; 

1 1 storing at least one updated virus definition record into the structured virus 

12 database indexed by the identifier and the at least one virus name for each virus 

1 3 definition record; and 

14 converting the virus definition records stored in the structured virus 

1 5 database into a virus data file comprising virus definition sets, each virus 

1 6 definition set comprising: 

1 7 binary data encoding instructions to detect the computer virus 

1 8 within a computer system; 

] 9 instructions to clean the computer virus fi*om the computer system; 

20 and 

2 1 names associated with the computer virus. 

1 1 1 . A method according to Claim 1 0, fiirther comprising: 

2 converting each virus definition set in the virus data file into a virus 

3 definition record. 

1 1 2, A method according to Claim 1 0, further comprising: 

2 comparing subsequently modified versions of the structured virus database 

3 to form a delta set of virus definition records; and 
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4 storing the delta virus definition records set into the structured virus 

5 database. 



1 1 3 . A method according to Claim 1 2, further comprising: 

2 building the virus definition records into the structured virus database by 

3 generating the identifier for each virus definition record and populating each virus 

4 definition record with the virus definition sentence and the virus removal sentence 

5 for the computer virus. 

1 14. A method according to Claim 13, fiirther comprising: 

2 building a virus data file by organizing one or more virus definition sets 

3 into the virus data file; and 

4 converting each virus definition set in the virus data file into a virus 

5 definition record. 

1 1 5 . A method according to Claim 1 0, further comprising: 

2 accessing the virus definition records in the structured virus database to 

3 perform at least one of adding, removing, and replacing a virus definition record. 

1 1 6. A method according to Claim 1 0, further comprising: 

2 compressing the structured virus database prior to transfer; and 

3 decompressing the structured virus database subsequent to transfer. 

1 1 7. A method according to Claim 1 0, fiirther comprising: 

2 encrypting the structured virus database prior to transfer; and 

3 decrypting the structured virus database subsequent to transfer. 

1 1 8 . A method according to Claim 1 0, wherein the structured virus 

2 database is a relational database. 

1 1 9. A computer-readable storage medium holding code for performing 

2 the method of Claim 10. 
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1 20. A method for updating a binary computer virus data file from virus 

2 definition records stored in a structured virus database, comprising: 

3 means for storing virus definition records into a structured virus database, 

4 each virus definition record comprising an identifier, at least one virus name, a 

5 virus definition sentence defining operations to detect the identified computer 

6 virus, and a virus removal sentence defining operations to clean off the identified 

7 computer virus; 

8 means for comparing subsequently modified versions of the structured 

9 virus database to form a deha set of virus definition records; 

10 means for storing the delta virus definition records set into the structured 

1 1 virus database; and 

12 means for converting the virus definition records stored in the structured 

13 virus database into a virus data file comprising virus definition sets, each virus 

14 definition set comprising binary instructions to detect the computer virus, binary 

1 5 instructions to clean off the computer virus, and names associated with the 

16 computer virus. 
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